- Freeradius-Users - lists.freeradius.org

Quick question about RFC 3579 2.6.5
by Olivier Beytrison 26 Jan '13

26 Jan '13

Hi, Well, RFC 3579 2.6.5 says : If EAP-Message, then there MUST not be a Reply-Message. I understand the point on this based on the RFC. In my case (remember the eduroam design thread from a while back), I have several "local" Radius which proxy all request to my central radius, which in turn perform the authn+z for the users, or forward the request to the top level radius if the user do not belong to our organization (eduroam stuff, nothing new so far). So, I would like, in case of Access-Reject of OUR users, logging in OUR schools, to send back a reply-message to the local radius in the outer reply, so the local admin know why its user has been rejected. This would be logged then stripped before the reply reach the NAS. If it's an external user in our network, or one of our users but in an external network, then I won't add the Reply-Message. Would this still be illegal and would I end in jail ? ;) Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

4 4

Terminate PEAP on freeradius then proxy MSCHAPv2 to NPS
by Bertalan Voros 25 Jan '13

25 Jan '13

Hello All, Could someone tell me if it is possible to terminate PEAP on a freeradius server then proxy the request to an NPS server using MSCHAPv2? Thenk you and best regards, Bertalan

5 9

None
by Alireza Goftari 25 Jan '13

25 Jan '13

Hi, I’m trying to deploy FreeRadius as an accounting solution in my network. my scenario is like this: [image attached] Fortigate Firewall is already integrated with Active Directory and may send authenticated requests to FreeRadius, which is as well integrated with Active Directory. The work to be done: 1. using NAS (Fortigate Firewall in this case) attributes to do the accounting; 2. Specifying special Active Directory groups in FreeRadius configuration to have Internet access. May you help me with the solution or at least give me some hints? Thanks, Alireza Goftari

2 1

HuntGroup in FR1
by Lorenzo Milesi 25 Jan '13

25 Jan '13

Hi. I need to give user specific limitation based on where they connect to. I.e. I have two nas where the user can roam to, but when he logs into hs A he gets Max-Daily-Session := 60, while on B has no daily limit. Based on research, this should be done with Huntgroup. Current wiki page [1] doesn't eplain very much... I appended maxxer NAS-IP-Address == 87.24.AA.BB to /etc/freeradius/huntgroups In radiusd.conf, preprocess section, I have huntgroups = ${confdir}/huntgroups Running freeradius -x I see it reads huntgroups file, but if I try logging in to the NAS at ip 87.24.AA.BB the user doesn't get any special property. (Sadly) I'm (still) using FreeRadius 1.1.x. What did I do wrong? thanks [1] http://wiki.freeradius.org/config/Huntgroups -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

2 3

FreeRadius Accounting for Fortigate 311B
by Alireza Goftari 25 Jan '13

25 Jan '13

Hi, I’m trying to deploy FreeRadius as an accounting solution in my network. my scenario is like this: [image attached] Fortigate Firewall is already integrated with Active Directory and may send authenticated requests to FreeRadius, which is as well integrated with Active Directory. The work to be done: 1. using NAS (Fortigate Firewall in this case) attributes to do the accounting; 2. Specifying special Active Directory groups in FreeRadius configuration to have Internet access. May you help me with the solution or at least give me some hints? Thanks, Alireza Goftari

1 0

helps with User-Password
by Hocine M 25 Jan '13

25 Jan '13

Hello, A little question, when i run freeradius in debug mode ( freeradius -XX), ii can't see the User-Password! Sending Access-Request of id 167 to 195.220.94.130 port 1812 NAS-Port-Id = "AP41/1" Calling-Station-Id = "74-2F-68-ED-12-1C" Called-Station-Id = "00-0B-0E-A9-58-80:eduroam" Service-Type = Framed-User EAP-Message = 0x0201001a01756e69762d6c696c6c65332e6672406372752e6672 User-Name = "univ-lille3.fr(a)cru.fr" NAS-Port = 61847 This attibute must be displayed? Thanks

3 4

Dialup Admin
by Shawky Skaff 25 Jan '13

25 Jan '13

I was wondering if you can point me in the right direction for a couple of issues that I'm having - When I view a session of a user, it says user "bla" has 0 open session, which it weird because the user is connected. Where does radius get this info from? Is there anything that I need to change to fix it? - Is radkill still used? Is there anywhere I can obtain this from, the ftp link in the wiki times out after a while

2 2

Freeradius CoA - Need Help
by Nasser Heidari 24 Jan '13

24 Jan '13

Hi, I'm going to setup Freeradius CoA Virtual Server, I have already gone through originate-coa document, but need some help. This is the way that I traditionally originate CoA or POD packets: - I have wrote a Perl scripts that it listens on port 1810. - when I want to disconnect a user , I use another script to get user session info from DB , and then send it's information (User-Name, Acct-Session-ID, NAS IP Address) to port 1810 - then simply my perl scripts generates radclient commend and sends it to appropriate NAS. For the CoA it's same , the only different is that I send more AVP's to my script. Now what I couldn't understand is that, How should I trigger CoA server to send appropriate AVP's to NAS? How should I tell that I need these AVP's to be sent? I have Googled it but I couldn't find any sample. Thanks in advance. Regards, Nasser

2 2

Filter and attribute
by Emmanuel BILLOT 24 Jan '13

24 Jan '13

Hi, In LDAP config module, we can find filter = "(|(uid=%{%{Stripped-User-Name}:-%{User-Name}})(mail=%{%{Stripped-User-Name}:-%{User-Name}}))" Users authenticate in freeradius with login like pierre.dupont@12345678 We want to use both parts of adress in LDAP filter. pierre.dupont is %{User-Name} what should be the name of the variable for 12345678 ? -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 5

Re: Video installation for freeradius with smsotp
by Thomas Glanzmann 24 Jan '13

24 Jan '13

Hello Lasse, * Lasse Odden <lasse.odden(a)gmail.com> [2013-01-24 11:48]: > Long time since we spoke, but you told me you should try to find time > to do a new video with instructions. Could you please help me out > with this installation? I currently don't have the time, but if you have specific question, ask me. Thomas

1 0